This is actually one of the reasons I posted this, because I'm not sure, I'm not a lawyer and while I'm hopeful I got it right, I'd love guidance if I got it wrong.

Can you elaborate? What am I missing / what would I need to do to be GDPR compliant?